fix(auth-pg): make BCR and database clocks authoritative (TIN-2923)

.bazelrc

@@ -1,4 +1,9 @@
 common --enable_bzlmod
+common --registry=https://raw.githubusercontent.com/tinyland-inc/bazel-registry/ef734c4a26045a7b396913e6cf410e50fbe16635
+common --registry=https://bcr.bazel.build
+common --lockfile_mode=error
+# rules_js 2.9.1 package links retain the execution tree's external layout.
+common --legacy_external_runfiles
 
 build --jobs=auto
 build --worker_sandboxing

.github/workflows/ci.yml

@@ -8,29 +8,15 @@ on:
   workflow_dispatch:
 
 permissions:
-  actions: read
   contents: read
-  packages: read
 
 jobs:
   package:
-    uses: tinyland-inc/ci-templates/.github/workflows/js-bazel-package.yml@61cd1338ca9dae8a25985c0a36ff7beb111449be
+    # Exact-head TIN-89 canary. Replace this with the signed immutable v4
+    # release commit before merging; never fall back to the v3 publisher lane.
+    uses: tinyland-inc/ci-templates/.github/workflows/js-bazel-package.yml@6244d36f3048cf93672a8f37a873ec2db2cb09a3
     with:
       runner_mode: repo_owned
       runner_labels_json: ${{ vars.PRIMARY_LINUX_RUNNER_LABELS_JSON }}
-      workspace_mode: isolated
-      publish_mode: hosted_exception
-      node_versions: '["22"]'
-      publish_node_version: "22"
-      pnpm_version: "10.13.1"
-      typecheck_command: pnpm typecheck
-      unit_test_command: pnpm test:unit
-      build_command: pnpm build
-      package_check_command: pnpm check:package
-      bazel_targets: "//:pkg //:test"
-      package_dir: ./bazel-bin/pkg
-      npm_access: public
-      npm_publish_mode: disabled
-      github_package_name: "@tinyland-inc/tinyland-auth-pg"
-      dry_run: true
-    secrets: inherit
+      bazel_targets: "//:pkg //:typecheck //:test //:integration_test //:package_authority_test //:package_artifact_test //:auth_runtime_link_test"
+      verify_bzlmod_lock: true

BUILD.bazel

@@ -1,4 +1,6 @@
-load("@aspect_rules_js//npm:defs.bzl", "npm_package")
+load("@aspect_bazel_lib//lib:jq.bzl", "jq")
+load("@aspect_rules_js//js:defs.bzl", "js_test")
+load("@aspect_rules_js//npm:defs.bzl", "npm_link_package", "npm_package")
 load("@aspect_rules_ts//ts:defs.bzl", "ts_project")
 load("@tummycrypt_tinyland_auth_pg_npm//:defs.bzl", "npm_link_all_packages")
 load("@tummycrypt_tinyland_auth_pg_npm//:vitest/package_json.bzl", vitest_bin = "bin")
@@ -7,6 +9,64 @@ package(default_visibility = ["//visibility:public"])
 
 npm_link_all_packages(name = "node_modules")
 
+# The auth source/type edge is owned here and comes only from Bzlmod. Rewrap the
+# external package tree so Node resolves its runtime links from this consumer's
+# lock-derived stores instead of producer-local runfile paths.
+filegroup(
+    name = "tinyland_auth_registry_files",
+    srcs = ["@tummycrypt_tinyland_auth//:pkg"],
+)
+
+npm_package(
+    name = "tinyland_auth_registry_package",
+    srcs = [":tinyland_auth_registry_files"],
+    include_external_repositories = ["tummycrypt_tinyland_auth+"],
+    package = "@tummycrypt/tinyland-auth",
+    root_paths = ["pkg"],
+    version = "0.3.3",
+)
+
+npm_link_package(
+    name = "node_modules/@tummycrypt/tinyland-auth",
+    deps = {
+        ":.aspect_rules_js/node_modules/bcryptjs@2.4.3": "bcryptjs",
+        ":.aspect_rules_js/node_modules/nanoid@5.1.9": "nanoid",
+        ":.aspect_rules_js/node_modules/otplib@12.0.1": "otplib",
+        ":.aspect_rules_js/node_modules/qrcode@1.5.4": "qrcode",
+    },
+    src = ":tinyland_auth_registry_package",
+)
+
+AUTH_PG_NPM_DEPS = [
+    ":node_modules",
+    ":node_modules/@neondatabase/serverless",
+    ":node_modules/@tummycrypt/tinyland-auth",
+    ":node_modules/@types/node",
+    ":node_modules/@types/pg",
+    ":node_modules/drizzle-orm",
+    ":node_modules/pg",
+]
+
+PACKAGE_AUTHORITY_DATA = [
+    ":node_modules",
+    ":node_modules/vitest",
+    ".bazelrc",
+    ".github/workflows/ci.yml",
+    "BUILD.bazel",
+    "CHANGELOG.md",
+    "Justfile",
+    "MODULE.bazel",
+    "MODULE.bazel.lock",
+    "README.md",
+    "package.json",
+    "pnpm-lock.yaml",
+    "pnpm-workspace.yaml",
+    "src/__tests__/package-authority.test.ts",
+    "tests/bzlmod-consumer/BUILD.fixture",
+    "tests/bzlmod-consumer/MODULE.bazel.template",
+    "vitest.config.ts",
+]
+
 ts_project(
     name = "tinyland-auth-pg",
     srcs = glob(["src/**/*.ts"], exclude = ["src/__tests__/**"]),
@@ -18,43 +78,126 @@ ts_project(
     transpiler = "tsc",
     tsconfig = "tsconfig.json",
     validate = False,
-    deps = [
+    deps = AUTH_PG_NPM_DEPS,
+)
+
+ts_project(
+    name = "typecheck",
+    srcs = glob(["src/**/*.ts"], exclude = ["src/__tests__/**"]),
+    declaration = False,
+    no_emit = True,
+    transpiler = "tsc",
+    tsconfig = "tsconfig.json",
+    validate = False,
+    deps = AUTH_PG_NPM_DEPS,
+)
+
+vitest_bin.vitest_test(
+    name = "test",
+    args = [
+        "run",
+        "--exclude",
+        "src/__tests__/node-pg.test.ts",
+        "--exclude",
+        "src/__tests__/postgres-js.test.ts",
+    ],
+    data = glob([
+        "drizzle/**",
+        "drizzle-public/**",
+        "src/**/*.ts",
+    ]) + [
         ":node_modules",
-        ":node_modules/@neondatabase/serverless",
         ":node_modules/@tummycrypt/tinyland-auth",
-        ":node_modules/@types/node",
-        ":node_modules/@types/pg",
-        ":node_modules/drizzle-orm",
-        ":node_modules/pg",
+        ".bazelrc",
+        "BUILD.bazel",
+        "Justfile",
+        "MODULE.bazel",
+        "MODULE.bazel.lock",
+        "package.json",
+        "pnpm-lock.yaml",
+        "pnpm-workspace.yaml",
+        "tsconfig.json",
+        "vitest.config.ts",
     ],
+    log_level = "info",
 )
 
+# The database behavior proof is its own graph node. It may skip for a local
+# developer without a container runtime, but the remote validation target sets
+# AUTH_PG_INTEGRATION_REQUIRED and therefore fails closed if PostgreSQL cannot
+# actually be started.
 vitest_bin.vitest_test(
-    name = "test",
-    args = ["run"],
+    name = "integration_test",
+    args = [
+        "run",
+        "$(rootpath src/__tests__/node-pg.test.ts)",
+        "$(rootpath src/__tests__/postgres-js.test.ts)",
+    ],
     data = glob([
         "drizzle/**",
         "drizzle-public/**",
         "src/**/*.ts",
     ]) + [
         ":node_modules",
+        ":node_modules/@tummycrypt/tinyland-auth",
         "tsconfig.json",
         "vitest.config.ts",
     ],
+    env = {"AUTH_PG_INTEGRATION_REQUIRED": "true"},
+    log_level = "info",
+)
+
+vitest_bin.vitest_test(
+    name = "package_authority_test",
+    args = [
+        "run",
+        "--config",
+        "$(rootpath vitest.config.ts)",
+        "$(rootpath src/__tests__/package-authority.test.ts)",
+    ],
+    data = PACKAGE_AUTHORITY_DATA,
     log_level = "info",
 )
 
+jq(
+    name = "publish_package_json",
+    srcs = ["package.json"],
+    filter = ".peerDependencies = {\"@tummycrypt/tinyland-auth\": \"^0.3.0\"} | del(.devDependencies, .scripts)",
+    out = "package.publish.json",
+)
+
 npm_package(
     name = "pkg",
+    data = [
+        ":node_modules/@tummycrypt/tinyland-auth",
+    ],
     srcs = glob([
         "drizzle/**",
         "drizzle-public/**",
     ]) + [
         ":tinyland-auth-pg",
         "CHANGELOG.md",
         "README.md",
-        "package.json",
+        ":publish_package_json",
     ],
     package = "@tummycrypt/tinyland-auth-pg",
-    version = "0.2.4",
+    replace_prefixes = {
+        "package.publish.json": "package.json",
+    },
+    version = "0.2.5",
+)
+
+js_test(
+    name = "package_artifact_test",
+    entry_point = "tests/package-artifact.test.mjs",
+    args = ["$(rootpath :pkg)"],
+    data = [":pkg"] + AUTH_PG_NPM_DEPS,
+)
+
+js_test(
+    name = "auth_runtime_link_test",
+    entry_point = "tests/auth-runtime-link.test.mjs",
+    data = [
+        ":node_modules/@tummycrypt/tinyland-auth",
+    ],
 )

CHANGELOG.md

@@ -4,6 +4,45 @@ All notable changes to `@tummycrypt/tinyland-auth-pg` will be documented here.
 Format loosely follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/);
 this package uses pre-1.0 semver where **breaking changes bump the minor**.
 
+## [0.2.5] - Unreleased
+
+### Changed
+
+- Resolve `@tummycrypt/tinyland-auth` source and types exclusively from the
+  exact `tummycrypt_tinyland_auth@0.3.3` Bzlmod dependency in
+  `tinyland-inc/bazel-registry`, then rewrap `//:pkg` with consumer-owned,
+  lock-derived third-party stores instead of an npm peer/development edge.
+- Generate the compatibility manifest under Bazel so its intentional
+  `@tummycrypt/tinyland-auth@^0.3.0` peer metadata does not restore a
+  first-party package-manager build edge. Canonical consumption remains the
+  `tummycrypt_tinyland_auth_pg` Bzlmod module.
+- Route compile, typecheck, tests, and package assembly through finite Bazel
+  targets. The module, source manifest, package target, and eventual signed tag
+  must carry one version before a BCR append is proposed.
+- Remove npmjs and GitHub Packages publication from the active lane. A signed
+  source tag becomes consumable only through a reviewed, append-only
+  `tinyland-inc/bazel-registry` entry after exact-head remote graph proof.
+- Retire the alternate Nix pnpm/tsc package derivation; the flake now supplies
+  only the reproducible development shell for the Bazel authority.
+
+### Added
+
+- Contract coverage for package identity/version parity, first-party
+  package-manager edge rejection, the explicit Node runtime-store closure,
+  auth runtime resolution, the external-consumer fixture, CI publication
+  prohibition, and both packaged SQL migration trees.
+
+### Fixed
+
+- Make PostgreSQL's UTC clock and `expires_at` column authoritative for every
+  session-read path. Reads no longer parse driver-rendered naive timestamps or
+  delete expired rows; the explicit, tenant-scoped janitor alone deletes rows,
+  including the exact expiry boundary.
+- Add destructive DateStyle, process-timezone, client-clock, exact-boundary,
+  tenant-isolation, and node-postgres/postgres.js parity coverage against real
+  PostgreSQL. The remote graph has a dedicated integration target that refuses
+  to turn missing container infrastructure into a green skip.
+
 ## [0.2.4] — 2026-04-28
 
 ### Added